Detect mshta exe running scripts in command-line arguments

Description

This search looks for the execution of "mshta.exe" with command-line arguments that launch a script. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "mshta.exe" and its parent process.

Content Mapping

This content is not mapped to any local saved search. Add mapping


Use Case

Security Monitoring

Category

Endpoint Compromise

Alert Volume

This search looks for the execution of "mshta.exe" with command-line arguments that launch a script. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "mshta.exe" and its parent process.

SPL Difficulty

None

Journey

Stage 3